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REMARKS 

Claims 1-2, 4-6, 8-11, 15-18 and 20 are pending in this application. Reconsideration 
of the rejection is respectfully requested in light of the following remarks. 

Applicants appreciate the courtesies shown to Applicants' representatives by Examiner 
Vu in the February 22 personal interview. Applicants' separate record of the substance of the 
interview is incorporated into the following remarks. The Examiner agreed that the "purpose" 
feature discussed below is different from what is disclosed by the prior art and indicated that 
he would perform an updated search. 

The independent claims of the present application recite that each personal certificate 
that is processed includes an element that conveys a "purpose of operation" for the certificate. 
As discussed during the personal interview with Examiner Vu, an element that conveys a 
"purpose of operation" is not the same as an element that conveys merely a name or an 
identity of a person to whom a certificate has been issued. For example: 

1) An individual with one identity may be issued multiple certificates by the same 
certificate authority, each certificate including a specifically assigned purpose; 

2) Each certificate issued to an individual may be issued by a separate certificate 
authority that is accredited to issue certificates for the "purpose" identified in the certificate; 

3) A server capable of authenticating a certificate that indicates a "purpose" does not 
have to maintain large access rights tables that include an entry for each certificate holder 
identity. Rather, the server may maintain an access rights table with much fewer entries 
based upon the set of "purposes" supported by the server; 

4) A server that maintains an access rights table based upon a set of recognized 
"purposes" may reallocate the physical resources and logical access available to each 
"purpose" without requiring that previously issues certificates be reissued. 
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Claims 1,4-5, 15 and 17 recite, inter alia, extracting "at least one of predetermined 
elements in a hierarchy of a subject name included in the received personal certificate 
. . . .wherein the predetermined elements includes an element allocated for representing a 
purpose of operation to be operated by the holder of the personal certificate ." Claims 8, 
16 and 18 recite, inter alia, extracting "a predetermined element in a hierarchy of a subject 
name included in the received personal certificate. . ..wherein the predetermined element in a 
hierarchy of the subject name represents a purpose of operation to be operated by the 
holder of the personal certificate ." Claim 20 recites, inter alia, extracting "a predetermined 
element in a hierarchy of a subject name included in the received personal 
certificate. . ..wherein the predetermined elements includes an organizational unit name 
allocated for representing a project name and a common name allocated for representing a 
purpose of operation of the project ." Support for these claims may be found throughout the 
specification. For example, specific support may be found at Fig. 6; Fig. 7; original claims 3 
and 7; page 8, lines 19-20; page 9, lines 6-8; page 12, line 24 through page 13, line 10. 

I. S103 Rejection 

Claims 1-2, 4, 8-1 1, 15-18 and 20 stand rejected under 35 U.S.C. §103(a) over U.S. 
Patent 6,088,805 to Davis et al. ("Davis 1 ') in view of U.S. Patent 5,922,074 to Richard et al. 
("Richard"). This rejection is respectfully traversed. 

The Office Action states on page 3 that, "Davis does not detail the predetermined 
elements includes an element allocated for representing a purpose of operation (i.e., a subject 
name) to be operated by the holder of the personal certificate" and relies upon Richard to fill 
that deficiency. The Office Action further states on page 3, "Richard discloses a server 
determines the access rights to grant to a client and a method to verify a certificate includes a 
validity field and subject field specifies the name of the party who holds the certificate." The 
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Office Action then asserts that it would have been obvious for one having ordinary skill in the 
art at the time that the invention was made to incorporate the subject name as an element to 
determine the access right to the client as taught by Richard into the Davies apparatus in order 
to improve the security services within a network. 

Apparently, the Office Action mistakenly equates an element containing a "subject 
name," as described in Richard, with an element that contains "a purpose of operation to be 
operated by the holder of the personal certificate," as recited in the claims. Applicants 
respectfully assert that these features are not the same, as discussed below. 

Applicant respectfully submits, as discussed above, that 1-2, 4, 8-1 1, 15-18 and 20 
recite a subject name that includes a hierarchy of predetermined elements and that the 
hierarchy includes an element that represents a purpose of operation . Richard may disclose a 
certificate that includes a "subject field [that] specifies the name of the party who holds the 
certificate." However, an element that identifies the "the name of the party who holds the 
certificate" is not the same as an element that represents "a purpose of operation to be 
operated by the holder of the personal certificate," as recited in the claims. Applicant 
respectfully submits that the Davis/Richard combination does not disclose, teach or suggest 
such a feature, nor would it have been obvious for one having ordinary skill in the art at the 
time that the invention was made to include within a certificate an element that represents "a 
purpose of operation to be operated by the holder of the personal certificate," as recited in the 
claims. 

Davis discloses organization name and sub-field organization unit name such as 
"IBM" and "Human Resources" (Col. 7, lines 12-30). Furthermore, Davis discloses the name 
of the organization to which the client belongs (Col. 9, lines 1-10). Richard, discloses at col. 
2, lines 30-39, and col. 7, lines 24-48, the use of the identity of a user, as determined from a 
personal certificate, to determine the access rights of the user. 
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However, the Davis/Richard combination does not disclose an element allocated for 
representing "a purpose of operation to be operated by the holder of the personal certificate," 
as recited in the claims. Therefore, the Davis/Richard combination can distinguish whether 
the person who belongs to a specific organization and the identity of a person, but cannot 
distinguish the person who operates a specific operation which is operated for a specific 
purpose. A person belonging to an organization / identity of a person and a person who 
operates a specific operation for a specific purpose are not necessarily identical. 

Determining the rights of a user based upon the user's organization or identity requires 
access to a lookup table or directory that maintains user rights, or privileges, based upon a 
user's organization or a user's identity. Such a lookup table or directory would require 
maintenance of access rights on a per organization or per user name basis. On the other hand, 
an approach which determines user rights based upon a purpose assigned to a personal 
certificate does not require maintenance of and/or access to a lookup table or directory that 
maintains user rights, or privileges, based upon an organization name or user name. 
Therefore, access to a lookup table or directory that maintains user rights, or privileges, based 
upon an organization name or a user name is not required. 

Accordingly, it is respectfully submitted that claims 1, 4, 8, 15-18 and 20 are 
patentably distinguishable over the Davis/Richard combination. Claims 2, 6 and 9-11 depend 
from independent claims 1, 5 and 8, respectfully, and are likewise patentably distinguishable 
over the Davis/Richard combination for at least their dependence on an allowable base claim, 
as well as for additional features they recite. Accordingly, withdrawal of this rejection is 
respectfully requested. 



-5- 



Application No. 09/987,418 

II. §103 Rejection of claims 5-6 

The Office Action rejects claims 5-6 under 35 U.S.C. §103 as unpatentable over Davis 
in view of Richard and further in view of U.S. Patent 5,884,312 to Dustan et al. ("Dustan). 
This rejection is respectfully traversed. Claim 5 recites, inter alia, "wherein the 
predetermined elements includes an element allocated for representing a purpose of operation 
to be operated by the holder of the personal certificate." 

The Office Action states in rejecting claim 5, that the Davis/Richard/Dustan 
combination discloses use of predetermined elements that include a "purpose of operation." 
Specifically, the Office Action relies upon Richard and the disclosure of a "subject field 
specifies the name of the party who holds the certificate" for support for the Office Action's 
assertion that the "Davis/Richard/Dustan combination discloses use of predetermined 
elements that include a "purpose of operation." 

As discussed above, a person belonging to an organization / identity of a person and a 
person who operates a specific operation for a specific purpose are not necessarily identical. 
Therefore, Applicant respectfully submits that the Davis/Richard combination does not 
disclose, teach or suggest use of an element that represents "a purpose of operation to be 
operated by the holder of the personal certificate," as recited in the claims, nor would it have 
been obvious for one having ordinary skill in the art at the time that the invention was made 
to include such a feature. 

Accordingly, it is respectfully submitted that claim 5 is patentably distinguishable 
over Davis/Richard/Dustan. Claim 6 depends from independent claim 5 and is likewise 
patentably distinguishable over Davis/Dustan for at least its dependence on an allowable base 
claim, as well as for additional features it recites. Accordingly, withdrawal of this rejection is 
respectfully requested. 
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III. Conclusion 

In view of the foregoing, it is respectfully submitted that this application is in 
condition for allowance. Favorable reconsideration and prompt allowance of claims 1-2, 4-6, 
8-11, 15-18 and 20 are earnestly solicited. 

Should the Examiner believe that anything further would be desirable in order to place 
this application in even better condition for allowance, the Examiner is invited to contact the 
undersigned at the telephone number set forth below. 



Respectfully submitted, 



Jdmes A. Oliff 
Registration No. 27,075 




J. Adam Neff 
Registration No. 41,218 



JAO:JMH/hs 



Date: February 25, 2005 



Oliff & Berridge, plc 
P.O. Box 19928 
Alexandria, Virginia 22320 
Telephone: (703) 836-6400 



DEPOSIT ACCOUNT USE 
AUTHORIZATION 



Please grant any extension 

necessary for entry; 
Charge any fee due to our 
Deposit Account No. 15-0461 



-7- 



